A AegiFlow
CRITICALCVSS 9.3EPSS 2.6%

CVE-2026-56265

Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server

Published
2026-06-21
Modified
2026-09-14
EPSS percentile
85%
Aliases
GHSA-8qrg-7j2f-rf2h
Sources
github-advisory

Summary

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Affected packages

EcosystemPackageAffected versionsFixed versions
PyPIcrawl4ai—0.8.7

Remediation: Upgrade to 0.8.7 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.